canvas-bot
f97f5d2788
Previous audit allowed up to 5 requests in a 30s window — generous, hid real regressions. Tighten: - 5s settle after each scene becomes interactive (covers the burst of mount-time fetches every scene legitimately fires) - 55s observation window after settle, sized to fit between two consecutive 60s topbar badge polls - MAX_REQ_PER_WINDOW = 0; any /api/* or /internal/* request during the window fails the assertion This is the operator-experience contract: when you stop typing, canvas stops fetching.